A local privilege escalation vulnerability in Realtek Andrea RT Filters 1.0.64.7 could allow an authenticated local attacker to execute arbitrary code with system-level privileges.

This is an unquoted service path vulnerability (CWE-428) involving the AESTSr64.exe executable. By placing a malicious binary in a specific directory within the unquoted path, a local user can trick the service into executing unauthorized code during system startup or reboot.

Successful exploitation of this vulnerability allows a local user to achieve full system compromise by gaining elevated privileges. This poses a significant risk to data integrity, confidentiality, and system availability, as the attacker could install malware, modify system files, or disable security controls. With a CVSS score of 7.8, this flaw represents a high-severity risk that requires prompt attention in environments where untrusted local access is a concern.

Immediate Action: Update the Realtek Andrea RT Filters software to the latest available version provided by the vendor to resolve the service path configuration.

Proactive Monitoring: Audit Windows services for unquoted service paths using tools like wmic or PowerShell to identify other potential vulnerabilities in the environment.

Compensating Controls: Restrict local write permissions on the C: drive and other critical system directories to prevent unauthorized users from placing malicious executables in vulnerable paths.

Public Exploit Available: Yes, a technical write-up and proof-of-concept are available via ExploitDB (EDB-ID 49158).

Given the availability of a public proof-of-concept and the potential for full system compromise, administrators should prioritize the remediation of this vulnerability. Ensure that all systems running Realtek Andrea RT Filters are updated to a patched version and implement strict least-privilege policies for local users to mitigate the risk of unauthorized code execution.